Threats tagged 'rustsec-2026-0509'

A vulnerability in Hickory net's DNSSEC validation allows acceptance of NSEC3 records from unrelated zones during proofs of nonexistence. This occurs because only the hashed first label of the NSEC3 owner name was compared, ignoring the zone context. An attacker controlling any DNSSEC-signed zone can exploit this to mislead validators about the nonexistence of names in other zones. The issue affects versions before 0.26.2 and is fixed in version 0.26.2.